Cold email is the highest-ROI channel for both candidate outreach and client development in recruitment. This guide covers GDPR legal basis, candidate and BD templates, deliverability setup, and response rate benchmarks for 2026.
Legitimate Interest (Article 6(1)(f)) is the correct basis for most recruiter outreach
Recruiters can lawfully contact candidates under GDPR Legitimate Interest, provided: (1) the outreach is relevant to the candidate’s professional background; (2) the candidate would reasonably expect to be contacted by recruiters given their public profile; (3) you include a clear, easy opt-out in every email; (4) you maintain and honour a suppression list; and (5) you inform the candidate how you obtained their data (e.g. LinkedIn, CV database).
Include in every candidate email
Your name, firm name, and contact details Why you’re contacting them (data source) Clear opt-out / unsubscribe link Job relevance (why they fit this role)
Include in every BD email
Your name, firm, and registration number (if applicable) Clear identification as recruitment business development Unsubscribe mechanism ICO registration number if processing personal data
Subject: Staff Eng role at {{company}} - {{location}}
Hi {{first_name}},
I came across your profile via LinkedIn - your work on {{specific_technology or project}} at {{current_company}} caught my attention.
I’m working with a {{Series X}} {{company_descriptor}} in {{city/remote}} looking for a Staff/Principal Engineer to {{one-line scope}}. Comp: £{{range}} + meaningful equity. The team is {{size}}; you’d report directly to the CTO.
Open to hearing more?
{{Your name}}
{{Firm}} | {{phone}}
You received this because your LinkedIn profile indicates relevant experience. Reply STOP to opt out.
Subject: Senior AE role - {{vertical}} SaaS, £{{OTE}} OTE
Hi {{first_name}},
Saw you’ve been closing {{ICP}} deals at {{current_company}} - exactly the profile for a role I’m filling.
{{Client}}: £{{ARR}} ARR, {{funding_stage}}, expanding into {{territory}}. Looking for a Senior AE who can run a full sales cycle on deals £{{deal_size}}+. OTE £{{OTE}} (base £{{base}}), uncapped. {{remote/office}} based.
Worth a quick call this week?
{{Your name}}
{{Firm}}
Reply STOP to opt out of recruiter contact.
Subject: re: {{role}} - timing?
Hi {{first_name}},
Just bumping this up - completely understand if the timing isn’t right. If you’re open to a conversation in the next few months rather than right now, I’m happy to keep this on file and reach back out when it might be better timing.
Either way, worth 5 minutes now?
{{Your name}}
Subject: {{company}} hiring {{role}} - intro
Hi {{first_name}},
Noticed {{company}} has {{N}} open {{function}} roles on LinkedIn. We specialise in placing {{function}} talent at {{stage}} companies in {{sector}} - typically filling in 3-4 weeks with a 6-month placement guarantee.
Worth a 15-minute intro to see if we could support you on {{role}}?
{{Your name}}
{{Firm}} | {{website}}
Business development email. Opt out: reply STOP.
| Outreach type | Average response | Good benchmark | Key driver |
|---|---|---|---|
| LinkedIn InMail (passive candidate) | 10-25% | 25-40% | Role relevance + personalisation |
| Direct email (passive candidate) | 15-35% | 35-55% | Subject line + role compensation clarity |
| Follow-up email (Day 5-7) | 5-15% | 15-25% | Short, new angle, timing question |
| BD email to Head of People | 5-12% | 12-20% | Hiring trigger specificity |
| BD follow-up (after no response) | 3-8% | 8-15% | New value angle, not repeat |
Recruiter outreach domains are frequently flagged by spam filters because of high email volume and low engagement rates. Protect your primary domain:
Yes, under GDPR Article 6(1)(f) (Legitimate Interest) for candidates whose public profiles indicate relevant experience. Requirements: clearly identify yourself, explain why you’re contacting them, include easy opt-out, maintain suppression list, inform candidates how you obtained their data. PECR (UK) doesn’t restrict B2B email to business addresses, but sole traders are treated as individuals.
15-35% for passive candidates when the role is highly relevant and personalised. LinkedIn InMail averages 10-25%. Direct email to a verified address typically outperforms InMail by 20-30 percentage points with good personalisation. Below 10% usually means targeting needs refinement.
Under 150 words: (1) Subject: specific to role or their background. (2) First line: why you’re contacting them specifically. (3) Opportunity: company (if not confidential), role level, compensation range. (4) Why them: connect their background to this role. (5) Single CTA: question or 15-minute call offer. (6) Opt-out: required under GDPR Legitimate Interest.
Recruiter domains are high-risk for spam filtering. A bounce from an invalid candidate email hurts deliverability for every future send. BounceZero removes invalid addresses before they cause problems. $3/1K. 100 free credits.
Ayoub built BounceZero's 5-stage validation pipeline, its dedicated BGP-announced IP infrastructure, and the Patroni HA PostgreSQL cluster behind every verification. Previously built high-volume email delivery infrastructure. Trained at 1337 Benguerir (École 42 network, 2019). Open-source: bgp_analyzer.
Tailored use cases across teams and sectors
Verify candidate emails before outreach
Block fake signups, reduce fraud at KYC
Block invalid addresses at checkout and signup
Volume pricing, team accounts, GDPR-ready
Block disposable emails at signup - real-time API
Protect sender reputation before outreach
Explore other topics